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Amendments to the Claims: 

This listing of claims will replace all prior versions, and listings, of claims in the 
application: 

Listing of Claims; 

1. (Previously Presented) A method of monitoring a computer network for 
specified events at a presence, comprising: 

gathering heterogeneous data, as directed by the presence, at two or more remote 
computers and placing the gathered data in a data stream and forwarding the data stream 
to the presence; 

receiving, at the presence, the at least one data stream sent from the two or more 
remote computers, the data stream including data representative of events; and 

applying rules to the at least one data stream at the presence for sorting data 
representative of events and for taking one or more actions based on a specified event. 

2. (Original) The method of claim 1, comprising displaying events associated 
with a selected data stream on a time line. 

3. Cancelled. 

4. (Previously Presented) The method of claim 1, wherein said gathering step is 
performed by an agent. 

5. (Original) The method of claim 1, comprising hunting for predetermined data 
at a remote location and placing the hunted data in a data stream and forwarding the data 
stream to the computer. 

6. (Original) The method of claim 5, wherein said hunting step is performed by 
an agent. 

7. (Original) The method of claim 5, comprising normalizing the data before the 
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data is placed in the data stream. 



8. (Original) The method of claim 1, wherein the at least one data stream 
includes message traffic. 

Claims 9-13 (cancelled) 

14. (Original) The method of claim 1, comprising filing the sorted information in 
separate data stream files. 

15. (Original) The method of claim 1, wherein an event is comprised of at least 
one of the following elements: type, title, datetime, keywords, summary, priority and 
duration. 

16. (Original) The method of claim 1, wherein a rule includes a criteria 
component and an action component. 

17. (Original) The method of claim 16, wherein the criteria component includes 
at least one criteria statement and to satisfy a rule either all, any or none of the at least 
one criteria statements need to be satisfied. 

18. (Original) The method of claim 17, wherein at least one action is taken if the 
at least one rule is satisfied. 

19. (Original) The method of claim 1, wherein the data in the event data stream is 
received in a standardized format. 

20. (Original) The method of claim 14, comprising displaying an event stream 
using information stored in stored data stream files. 

21. (Cancelled) 
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22. (Previously Presented) An article usable to monitor a computer network 
for specified events at a presence, comprising: 
at least one sequence of machine executable instructions; 

a medium bearing the executable instructions in machine readable form, wherein 
execution of the instructions by one or more processors causes the one or more 
processors to: 

gather heterogeneous data, as directed by the presence, at two or more remote 
computers and place the gathered data in a respective data stream to the presence; 

receive at least one data stream at the presence, the data stream including data 
representative of events; and 

apply rules to the data stream at the presence, for sorting data representative of 
events and for taking one or more actions based on a specified event. 

23. (Original) The article of claim 22, comprising causing the processor to 
display events associated with a selected data stream on a time line. 

24. (Previously Presented) A computer architecture for monitoring a computer 
network at a presence for specified events, comprising: 

gathering means, at two or more remote computers, for gathering heterogeneous 
data, as directed by the presence, and placing the data in a respective data stream and 
forwarding the data stream to the presence; 

receiving means, at the presence, for receiving at least one data stream at a 
computer, the data stream including data representative of events; and 

applying means, at the presence, for applying rules to the at least one data stream 
for sorting data representative of events and for taking one or more actions based on a 
specified event. 

25. (Cancelled) 
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26. (Previously Presented) A computer system usable to monitor a computer network 
for specified events at a presence, comprising: 
a processor; and 

a memory coupled to said processor, the memory having stored therein sequences of 
instructions, which, when executed by said processor, causes said processor to perform the steps 
of: 

gathering heterogeneous data, as directed by the presence, at two or more remote 
computers and placing the gathered data in a respective data stream to the presence; 

receiving at least one data stream at the presence, the data stream including data 

representative of events; and 

applying rules to the data stream at the presence for sorting data representative of events 
and for taking one or more actions based on a specified event. 

27. (Original) The computer system of claim 26, comprising causing the processor to 
display events associated with a selected data stream on a time line. 

28. (Original) The method of claim 1, wherein said gathering step includes 
collecting/generating data at the two or more remote computers. 
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29. (Original) The method of claim 1 , wherein said gathering and reeiving step 
performed in reed-time. 



30. (New) The method of claim 1, wherein the action is a change in the rules for 
filtering, organizing and exploiting the sorted data. 

3 1 . (New) The method of claim 1, wherein the action is automatically brought to the 
attention of the user. 
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32. (New) The method of claim 31, wherein alert including one of an alert window, 

flashing icon, email and beeper notification is used automatically. 
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